Complete tier-appropriate due diligence before engaging

Vendor Management policy, §5.2, §13

Before any engagement, diligence scaled to the tier is completed and documented: a signed diligence memo with findings, gaps, and mitigations for critical providers; an approved diligence summary for material vendors; a brief approval memo or retained correspondence for standard vendors.

Event-driven

Each new vendor, before contract execution

Collect the items the tier requires, assess each category, decide under the risk framework, and have the Compliance Officer sign the memo or approve the summary.

• Diligence memo or summary

  Findings by category, gaps, mitigations, decision, sign-off

• Supporting materials

  Financials, attestations, insurance certificates, references

Compliance Officer

Leela can assemble the diligence checklist for the tier and draft the memo from what the vendor provides.

Tell Leela about your company to see whether this applies.